@joshuafolkken/kit 1.1178.0 → 1.1240.0

package/scripts/git/git-command.ts

@@ -1,5 +1,7 @@
 import { PORCELAIN_FLAG, UNTRACKED_FILES_FLAG } from './constants'
+import { git_diff_reads } from './git-diff-reads'
 import { create_spawn_error } from './git-execa-error'
+import { git_pre_push_hook } from './git-pre-push-hook'
 import { git_push_transport } from './git-push-transport'
 import { git_spawn } from './git-spawn'
 import { git_spawn_sync } from './git-spawn-sync'
@@ -73,211 +75,6 @@ async function diff_cached(file_path: string): Promise<string> {
 	return await git_spawn.read(['diff', '--cached', file_path])
 }
 
-const REFS_REMOTES_ORIGIN_PREFIX = 'refs/remotes/origin/'
-const NAME_ONLY_FLAG = '--name-only'
-const DEFAULT_BRANCH_FALLBACK = 'main'
-
-async function get_default_branch(): Promise<string> {
-	try {
-		const output = await git_spawn.read(['symbolic-ref', 'refs/remotes/origin/HEAD'])
-		const trimmed = output.trim()
-
-		if (trimmed.startsWith(REFS_REMOTES_ORIGIN_PREFIX)) {
-			return trimmed.slice(REFS_REMOTES_ORIGIN_PREFIX.length)
-		}
-	} catch {
-		// fall through to default
-	}
-
-	return DEFAULT_BRANCH_FALLBACK
-}
-
-const MERGE_BASE_COMMAND = 'merge-base'
-
-// **The ref the default branch is actually at**, which is not the same thing as its name
-// (joshuafolkken/kit#1535). `get_default_branch` returns the bare name, and git resolves that to the
-// *local* `refs/heads/<default>` — a ref nothing in this workflow advances, because merges happen on
-// GitHub and the default branch is checked out in no work tree. This is the single source both the
-// lane's start point and `change_base` below resolve through, so a lane cut from
-// `refs/remotes/origin/<default>` is measured against that same commit. Measured without it: a lane
-// cut from a remote-tracking ref three commits ahead reported those three commits' files as its own.
-//
-// It falls back to the bare name where there is no remote-tracking ref — a fresh `git init`, a clone
-// with no `origin` — which is the reading every caller had before. The one case it reads differently
-// is a local default branch *ahead* of the remote, which this workflow does not produce and
-// `prevent-main-commit.ts` exists to stop.
-async function reference_exists(reference: string): Promise<boolean> {
-	try {
-		await git_spawn.read(['rev-parse', '--verify', '--quiet', reference])
-
-		return true
-	} catch {
-		return false
-	}
-}
-
-async function default_branch_reference(): Promise<string> {
-	const default_branch = await get_default_branch()
-	const remote_reference = `${REFS_REMOTES_ORIGIN_PREFIX}${default_branch}`
-
-	return (await reference_exists(remote_reference)) ? remote_reference : default_branch
-}
-
-// The commit this branch was cut from — and the base every "changed" reading below measures
-// against, in place of the default branch itself.
-//
-// **A two-dot `git diff <default-branch>` compares a moving *ref* to the working tree, and in a
-// linked work tree that ref is shared with every other lane** (joshuafolkken/kit#1527). So when one
-// lane merges, an unmerged lane's diff picks that lane's files up in reverse: files this branch
-// never touched arrive in `josh review:brief`'s target list, in the digest map `josh gate` stamps,
-// and in `josh review:round2`'s fix delta.
-//
-// **The merge base is the fixed point that removes it**, because it is a commit rather than a ref:
-// an advance of the default branch that this branch is an ancestor of does not move it. It is also
-// the right answer at both points of a run, and a lane passes through both — with the work still
-// uncommitted `HEAD` is the cut commit and the merge base is that same commit, so the diff is the
-// uncommitted work; once the branch commits, `HEAD` moves ahead while the merge base stays put, so
-// the diff is the branch's whole change plus anything still uncommitted. `<default-branch>...HEAD`
-// answers neither, because a three-dot diff ends at `HEAD` and a lane's work is uncommitted for
-// most of its run.
-//
-// **It never reports less than the old reading did.** The new set is the branch's own change; the
-// old one was that same set plus the inverse of whatever the default branch had advanced by — so
-// this narrows the reading and cannot hide a file the branch actually changed.
-//
-// In a checkout sitting on the default branch the merge base *is* that branch's commit, so nothing
-// changes there. A repository with no common ancestor to find falls back to the previous reading
-// rather than failing the callers, all of which treat a throw as "nothing can be reused".
-async function change_base(): Promise<string> {
-	const default_branch = await default_branch_reference()
-
-	try {
-		return await git_spawn.read([MERGE_BASE_COMMAND, default_branch, 'HEAD'])
-	} catch {
-		return default_branch
-	}
-}
-
-async function diff_main(file_path: string): Promise<string> {
-	return await git_spawn.read(['diff', await change_base(), '--', file_path])
-}
-
-// Names only, for callers that classify a change rather than read it — `josh review:level` decides
-// the review depth from the paths alone, and reading the whole diff to get them would be the
-// expensive half of the thing it exists to make cheaper (joshuafolkken/kit#966).
-//
-// `core.quotePath=false` is not cosmetic. With git's default, a path containing any non-ASCII byte
-// comes back C-quoted — `"prompts/\343\202\263.md"` — and a classifier testing `startsWith('prompts/')`
-// against a string that begins with a quote character answers no. `review:level` fails safe there
-// (non-inert wins), but a classifier that answered `skip` would drop a change it is meant to catch,
-// so the quoting is turned off at the source every reader shares (joshuafolkken/kit#907).
-const NO_PATH_QUOTING: ReadonlyArray<string> = ['-c', 'core.quotePath=false']
-
-// Repository-root-relative paths, whatever the checkout is configured to prefer. `diff.relative` is
-// a per-repository setting a person may have turned on for their own reading, and with it `git diff
-// --name-only` run from a subdirectory prints cwd-relative paths — which every caller of this
-// reading then joins onto the repository root (joshuafolkken/kit#1257). The flag pins the spelling
-// at the source rather than leaving each caller to discover the configuration.
-const NO_RELATIVE_PATHS = '--no-relative'
-
-// **Rename detection is turned off because this listing is a description of a tree, not a summary of
-// a change** (joshuafolkken/kit#1533). With git's default `diff.renames=true`, a rename prints only
-// its *destination*: `git diff --name-only <base>` across a commit that moved `scripts/init-logic.ts`
-// to `scripts/init/init-logic.ts` names the second path and never the first.
-//
-// That omission is what breaks `josh gate`'s reuse. The green record it compares is `base` plus a
-// digest per listed path, and the whole claim that the record still describes the tree rests on one
-// property: **every path that differs from `base` is in the list**, so `base` plus the digests
-// determines the tracked tree completely. A rename's source path differs from `base` — it is gone —
-// and it is not in the list. So a tree in which the file was renamed away and a tree in which it has
-// since come back produce the *same* record: the returned file matches `base`, so it enters no diff,
-// while the destination is an addition either way. The gate then reuses a green taken on the first
-// tree for the second, without running one check on it, and a duplicated module that lint, the type
-// check and the unit suite would all have failed on is committed on a "passed".
-//
-// Off, a rename is listed as its two halves — a delete and an add — and the delete is what makes the
-// two trees compare unequal. `review-tree.ts` already records a listed path the tree does not hold
-// as `ABSENT_DIGEST` rather than dropping it, which is exactly the entry this flag produces.
-//
-// **Every other reader moves in the safe direction.** `josh review:level` sees
-// one more path and can only widen; `josh lint:related` and `josh test:related` drop what the tree
-// no longer holds through `changed-file-scope.ts`, which they already had to do for a plain delete.
-const NO_RENAME_DETECTION = '--no-renames'
-
-// The commit `change_base` resolves to. Every "changed" reading below is a diff against it, so a set
-// of changed paths — or a map of their digests — means nothing without it: fetch an advanced default
-// branch and rebase onto it, and each digest can stay identical while the rest of the tree is
-// replaced by code no check has read (joshuafolkken/kit#1328). A rebase still invalidates a stamp
-// taken against it — the rebase moves `HEAD`, and with it the merge base — while another lane
-// merging into the shared default branch no longer does, because it moves neither
-// (joshuafolkken/kit#1527).
-async function change_base_commit(): Promise<string> {
-	return await git_spawn.read(['rev-parse', await change_base()])
-}
-
-async function diff_main_names(): Promise<string> {
-	return await git_spawn.read([
-		...NO_PATH_QUOTING,
-		'diff',
-		NAME_ONLY_FLAG,
-		NO_RELATIVE_PATHS,
-		NO_RENAME_DETECTION,
-		await change_base(),
-		'--',
-	])
-}
-
-async function diff_cached_names(): Promise<string> {
-	return await git_spawn.read([
-		...NO_PATH_QUOTING,
-		'diff',
-		'--cached',
-		NAME_ONLY_FLAG,
-		NO_RELATIVE_PATHS,
-		NO_RENAME_DETECTION,
-	])
-}
-
-// The branch diff as `added\tdeleted\tpath` rows — the same base and flags as `diff_main_names`, so
-// the size read against and the name read agree on what "changed" is. A binary file prints `-` for
-// both counts; the parser above `josh split:assess` reads it treats those as zero changed lines.
-async function diff_main_numstat(): Promise<string> {
-	return await git_spawn.read([
-		...NO_PATH_QUOTING,
-		'diff',
-		'--numstat',
-		NO_RELATIVE_PATHS,
-		NO_RENAME_DETECTION,
-		await change_base(),
-		'--',
-	])
-}
-
-// Files git is not tracking yet. `git diff` never lists them, so a classifier built on the diff
-// alone sees a change that adds a whole new module as an empty one — which is how a run adding new
-// code could have been handed a reduced review level (joshuafolkken/kit#966).
-//
-// **`--full-name` and the `:/` pathspec are what make this reading agree with the diff beside it**
-// (joshuafolkken/kit#1257). `git diff --name-only` prints repository-root-relative paths for the
-// whole tree wherever it is run; `git ls-files --others` prints *cwd*-relative paths and lists only
-// what is below cwd. Read from a subdirectory, the two halves of `changed_paths` therefore came
-// back in two different coordinate systems, and every caller that resolves a path against the
-// repository root — `review-tree`, `josh test:related` — turned a new file into one that does not
-// exist, or, where the same tail exists elsewhere in the tree, into a different file entirely. The
-// pathspec restores the whole tree; the flag restores the root-relative spelling.
-const WHOLE_TREE_PATHSPEC = ':/'
-
-async function untracked_names(): Promise<string> {
-	return await git_spawn.read([
-		...NO_PATH_QUOTING,
-		'ls-files',
-		'--others',
-		'--exclude-standard',
-		'--full-name',
-		WHOLE_TREE_PATHSPEC,
-	])
-}
-
 // One branch from `origin`, fetched by name. `gh pr checkout` did this itself after resolving the
 // head branch through GraphQL, which a cloud session is answered 403 for (joshuafolkken/kit#1022);
 // the resolution moved to REST and the fetch is spelled out here instead of being re-wrapped.
@@ -380,22 +177,33 @@ function is_upstream_not_set_error(error: unknown): boolean {
 	return cause !== undefined && is_exit_code_128(cause)
 }
 
+const NO_VERIFY_FLAG = '--no-verify'
+
 // Both pushes go through `git_push_transport` rather than `git_spawn.with_output`, which is
 // what gives them a timeout and an SSH keepalive the local git commands beside them do not need
 // (joshuafolkken/kit#1251). The thrown error keeps the same `cause.exit_code` shape, so the 128
 // fallback below reads it exactly as it did.
-async function push_with_upstream(branch_name: string): Promise<void> {
-	await git_push_transport.push(['--set-upstream', 'origin', branch_name])
+async function push_with_upstream(
+	branch_name: string,
+	verify_flags: ReadonlyArray<string>,
+): Promise<void> {
+	await git_push_transport.push([...verify_flags, '--set-upstream', 'origin', branch_name])
 }
 
+// **The push budget bounds the transfer alone** (joshuafolkken/kit#3300). The pre-push hook runs once,
+// unbounded, before either push and outside the `try`; both transfers then skip it with `--no-verify`,
+// so neither the timeout retry nor the `--set-upstream` fallback repeats it, and a failed hook is not
+// mistaken for a missing upstream. A git too old to run the hook ahead leaves it to the push, as before.
 async function push(): Promise<void> {
+	const verify_flags = (await git_pre_push_hook.run()) ? [NO_VERIFY_FLAG] : []
+
 	try {
-		await git_push_transport.push([])
+		await git_push_transport.push([...verify_flags])
 	} catch (error) {
 		if (is_upstream_not_set_error(error)) {
 			const current_branch = await branch()
 
-			await push_with_upstream(current_branch)
+			await push_with_upstream(current_branch, verify_flags)
 
 			return
 		}
@@ -566,15 +374,9 @@ const git_command = {
 	head_commit,
 	git_directories,
 	diff_cached,
-	diff_cached_names,
-	diff_main,
-	change_base,
-	change_base_commit,
-	diff_main_names,
-	diff_main_numstat,
-	untracked_names,
-	get_default_branch,
-	default_branch_reference,
+	// The default branch, the change base and every reading against it are `git-diff-reads.ts`'s
+	// (joshuafolkken/kit#3264), re-exported here so no call site, mock or spy moved with them.
+	...git_diff_reads,
 	fetch_branch,
 	merge_fast_forward,
 	fast_forward_local,

package/scripts/git/git-diff-reads.ts

@@ -0,0 +1,225 @@
+import { git_spawn } from './git-spawn'
+
+// The default branch, the base a change is measured against, and every "changed" reading taken
+// against that base — split out of `git-command.ts` when it reached its line limit
+// (joshuafolkken/kit#3264). `git_command` re-exports each one under the name it always had, so the
+// move changed no call site and no suite that mocks or spies on `git_command`.
+
+const REFS_REMOTES_ORIGIN_PREFIX = 'refs/remotes/origin/'
+const NAME_ONLY_FLAG = '--name-only'
+const DEFAULT_BRANCH_FALLBACK = 'main'
+
+async function get_default_branch(): Promise<string> {
+	try {
+		const output = await git_spawn.read(['symbolic-ref', 'refs/remotes/origin/HEAD'])
+		const trimmed = output.trim()
+
+		if (trimmed.startsWith(REFS_REMOTES_ORIGIN_PREFIX)) {
+			return trimmed.slice(REFS_REMOTES_ORIGIN_PREFIX.length)
+		}
+	} catch {
+		// fall through to default
+	}
+
+	return DEFAULT_BRANCH_FALLBACK
+}
+
+const MERGE_BASE_COMMAND = 'merge-base'
+
+// **The ref the default branch is actually at**, which is not the same thing as its name
+// (joshuafolkken/kit#1535). `get_default_branch` returns the bare name, and git resolves that to the
+// *local* `refs/heads/<default>` — a ref nothing in this workflow advances, because merges happen on
+// GitHub and the default branch is checked out in no work tree. This is the single source both the
+// lane's start point and `change_base` below resolve through, so a lane cut from
+// `refs/remotes/origin/<default>` is measured against that same commit. Measured without it: a lane
+// cut from a remote-tracking ref three commits ahead reported those three commits' files as its own.
+//
+// It falls back to the bare name where there is no remote-tracking ref — a fresh `git init`, a clone
+// with no `origin` — which is the reading every caller had before. The one case it reads differently
+// is a local default branch *ahead* of the remote, which this workflow does not produce and
+// `prevent-main-commit.ts` exists to stop.
+async function reference_exists(reference: string): Promise<boolean> {
+	try {
+		await git_spawn.read(['rev-parse', '--verify', '--quiet', reference])
+
+		return true
+	} catch {
+		return false
+	}
+}
+
+async function default_branch_reference(): Promise<string> {
+	const default_branch = await get_default_branch()
+	const remote_reference = `${REFS_REMOTES_ORIGIN_PREFIX}${default_branch}`
+
+	return (await reference_exists(remote_reference)) ? remote_reference : default_branch
+}
+
+// The commit this branch was cut from — and the base every "changed" reading below measures
+// against, in place of the default branch itself.
+//
+// **A two-dot `git diff <default-branch>` compares a moving *ref* to the working tree, and in a
+// linked work tree that ref is shared with every other lane** (joshuafolkken/kit#1527). So when one
+// lane merges, an unmerged lane's diff picks that lane's files up in reverse: files this branch
+// never touched arrive in `josh review:brief`'s target list, in the digest map `josh gate` stamps,
+// and in `josh review:round2`'s fix delta.
+//
+// **The merge base is the fixed point that removes it**, because it is a commit rather than a ref:
+// an advance of the default branch that this branch is an ancestor of does not move it. It is also
+// the right answer at both points of a run, and a lane passes through both — with the work still
+// uncommitted `HEAD` is the cut commit and the merge base is that same commit, so the diff is the
+// uncommitted work; once the branch commits, `HEAD` moves ahead while the merge base stays put, so
+// the diff is the branch's whole change plus anything still uncommitted. `<default-branch>...HEAD`
+// answers neither, because a three-dot diff ends at `HEAD` and a lane's work is uncommitted for
+// most of its run.
+//
+// **It never reports less than the old reading did.** The new set is the branch's own change; the
+// old one was that same set plus the inverse of whatever the default branch had advanced by — so
+// this narrows the reading and cannot hide a file the branch actually changed.
+//
+// In a checkout sitting on the default branch the merge base *is* that branch's commit, so nothing
+// changes there. A repository with no common ancestor to find falls back to the previous reading
+// rather than failing the callers, all of which treat a throw as "nothing can be reused".
+async function change_base(): Promise<string> {
+	const default_branch = await default_branch_reference()
+
+	try {
+		return await git_spawn.read([MERGE_BASE_COMMAND, default_branch, 'HEAD'])
+	} catch {
+		return default_branch
+	}
+}
+
+async function diff_main(file_path: string): Promise<string> {
+	return await git_spawn.read(['diff', await change_base(), '--', file_path])
+}
+
+// Names only, for callers that classify a change rather than read it — `josh review:level` decides
+// the review depth from the paths alone, and reading the whole diff to get them would be the
+// expensive half of the thing it exists to make cheaper (joshuafolkken/kit#966).
+//
+// `core.quotePath=false` is not cosmetic. With git's default, a path containing any non-ASCII byte
+// comes back C-quoted — `"prompts/\343\202\263.md"` — and a classifier testing `startsWith('prompts/')`
+// against a string that begins with a quote character answers no. `review:level` fails safe there
+// (non-inert wins), but a classifier that answered `skip` would drop a change it is meant to catch,
+// so the quoting is turned off at the source every reader shares (joshuafolkken/kit#907).
+const NO_PATH_QUOTING: ReadonlyArray<string> = ['-c', 'core.quotePath=false']
+
+// Repository-root-relative paths, whatever the checkout is configured to prefer. `diff.relative` is
+// a per-repository setting a person may have turned on for their own reading, and with it `git diff
+// --name-only` run from a subdirectory prints cwd-relative paths — which every caller of this
+// reading then joins onto the repository root (joshuafolkken/kit#1257). The flag pins the spelling
+// at the source rather than leaving each caller to discover the configuration.
+const NO_RELATIVE_PATHS = '--no-relative'
+
+// **Rename detection is turned off because this listing is a description of a tree, not a summary of
+// a change** (joshuafolkken/kit#1533). With git's default `diff.renames=true`, a rename prints only
+// its *destination*: `git diff --name-only <base>` across a commit that moved `scripts/init-logic.ts`
+// to `scripts/init/init-logic.ts` names the second path and never the first.
+//
+// That omission is what breaks `josh gate`'s reuse. The green record it compares is `base` plus a
+// digest per listed path, and the whole claim that the record still describes the tree rests on one
+// property: **every path that differs from `base` is in the list**, so `base` plus the digests
+// determines the tracked tree completely. A rename's source path differs from `base` — it is gone —
+// and it is not in the list. So a tree in which the file was renamed away and a tree in which it has
+// since come back produce the *same* record: the returned file matches `base`, so it enters no diff,
+// while the destination is an addition either way. The gate then reuses a green taken on the first
+// tree for the second, without running one check on it, and a duplicated module that lint, the type
+// check and the unit suite would all have failed on is committed on a "passed".
+//
+// Off, a rename is listed as its two halves — a delete and an add — and the delete is what makes the
+// two trees compare unequal. `review-tree.ts` already records a listed path the tree does not hold
+// as `ABSENT_DIGEST` rather than dropping it, which is exactly the entry this flag produces.
+//
+// **Every other reader moves in the safe direction.** `josh review:level` sees
+// one more path and can only widen; `josh lint:related` and `josh test:related` drop what the tree
+// no longer holds through `changed-file-scope.ts`, which they already had to do for a plain delete.
+const NO_RENAME_DETECTION = '--no-renames'
+
+// The commit `change_base` resolves to. Every "changed" reading below is a diff against it, so a set
+// of changed paths — or a map of their digests — means nothing without it: fetch an advanced default
+// branch and rebase onto it, and each digest can stay identical while the rest of the tree is
+// replaced by code no check has read (joshuafolkken/kit#1328). A rebase still invalidates a stamp
+// taken against it — the rebase moves `HEAD`, and with it the merge base — while another lane
+// merging into the shared default branch no longer does, because it moves neither
+// (joshuafolkken/kit#1527).
+async function change_base_commit(): Promise<string> {
+	return await git_spawn.read(['rev-parse', await change_base()])
+}
+
+async function diff_main_names(): Promise<string> {
+	return await git_spawn.read([
+		...NO_PATH_QUOTING,
+		'diff',
+		NAME_ONLY_FLAG,
+		NO_RELATIVE_PATHS,
+		NO_RENAME_DETECTION,
+		await change_base(),
+		'--',
+	])
+}
+
+async function diff_cached_names(): Promise<string> {
+	return await git_spawn.read([
+		...NO_PATH_QUOTING,
+		'diff',
+		'--cached',
+		NAME_ONLY_FLAG,
+		NO_RELATIVE_PATHS,
+		NO_RENAME_DETECTION,
+	])
+}
+
+// The branch diff as `added\tdeleted\tpath` rows — the same base and flags as `diff_main_names`, so
+// the size read against and the name read agree on what "changed" is. A binary file prints `-` for
+// both counts; the parser above `josh split:assess` reads it treats those as zero changed lines.
+async function diff_main_numstat(): Promise<string> {
+	return await git_spawn.read([
+		...NO_PATH_QUOTING,
+		'diff',
+		'--numstat',
+		NO_RELATIVE_PATHS,
+		NO_RENAME_DETECTION,
+		await change_base(),
+		'--',
+	])
+}
+
+// Files git is not tracking yet. `git diff` never lists them, so a classifier built on the diff
+// alone sees a change that adds a whole new module as an empty one — which is how a run adding new
+// code could have been handed a reduced review level (joshuafolkken/kit#966).
+//
+// **`--full-name` and the `:/` pathspec are what make this reading agree with the diff beside it**
+// (joshuafolkken/kit#1257). `git diff --name-only` prints repository-root-relative paths for the
+// whole tree wherever it is run; `git ls-files --others` prints *cwd*-relative paths and lists only
+// what is below cwd. Read from a subdirectory, the two halves of `changed_paths` therefore came
+// back in two different coordinate systems, and every caller that resolves a path against the
+// repository root — `review-tree`, `josh test:related` — turned a new file into one that does not
+// exist, or, where the same tail exists elsewhere in the tree, into a different file entirely. The
+// pathspec restores the whole tree; the flag restores the root-relative spelling.
+const WHOLE_TREE_PATHSPEC = ':/'
+
+async function untracked_names(): Promise<string> {
+	return await git_spawn.read([
+		...NO_PATH_QUOTING,
+		'ls-files',
+		'--others',
+		'--exclude-standard',
+		'--full-name',
+		WHOLE_TREE_PATHSPEC,
+	])
+}
+
+const git_diff_reads = {
+	change_base,
+	change_base_commit,
+	default_branch_reference,
+	diff_cached_names,
+	diff_main,
+	diff_main_names,
+	diff_main_numstat,
+	get_default_branch,
+	untracked_names,
+}
+
+export { git_diff_reads }

package/scripts/git/git-error.ts

@@ -12,21 +12,15 @@ function get_stderr_from_error(cause: Error): string | undefined {
 function get_error_message_from_cause(cause: Error): string | undefined {
 	const message = cause.message.trim()
 
-	if (message.length > 0) {
-		return message
-	}
+	if (message.length > 0) return message
 
 	return get_stderr_from_error(cause)
 }
 
 function get_cause_message(cause: unknown): string | undefined {
-	if (cause instanceof Error) {
-		return get_error_message_from_cause(cause)
-	}
+	if (cause instanceof Error) return get_error_message_from_cause(cause)
 
-	if (typeof cause === 'string') {
-		return cause.trim()
-	}
+	if (typeof cause === 'string') return cause.trim()
 
 	return undefined
 }
@@ -34,9 +28,7 @@ function get_cause_message(cause: unknown): string | undefined {
 function display_error_details(cause: unknown): void {
 	const cause_message = get_cause_message(cause)
 
-	if (cause_message === undefined || cause_message.length === 0) {
-		return
-	}
+	if (cause_message === undefined || cause_message.length === 0) return
 
 	console.error('')
 	console.error('💡 Details:', cause_message)

package/scripts/git/git-pre-push-hook.ts

@@ -0,0 +1,139 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { git_spawn } from './git-spawn'
+
+// The pre-push hook, run ahead of the push instead of inside it (joshuafolkken/kit#3300).
+//
+// **The push budget is a transfer budget, and a hook is not a transfer.** `PUSH_TIMEOUT_MS` was read
+// off what moving objects costs here, but `git push` runs the pre-push hook first and the budget
+// counted it: a hook that ran the whole unit suite — any push the gate's record does not cover, such
+// as the observation ledger commit or a tree `ship` has just synced with main — took 130 to 196
+// seconds and was killed at 120 on a push that was healthy. Killing `git` did not kill the hook
+// either: lefthook and vitest outlived it, and the retry started a second suite in the same work tree,
+// where each `test-state-guard` read the other's temporary files as a mutation and both failed.
+//
+// So the hook runs here, once, with no budget, and `git_command.push` spawns the bounded transfer that
+// follows with `--no-verify`. The retry then repeats the transfer alone, and a hook that is still
+// running cannot exist for it to overlap.
+//
+// **What git hands the hook is reproduced rather than dropped.** `git hook run` executes whatever
+// hook is configured — lefthook's or anyone's — and the arguments and stdin are git's pre-push
+// contract: the remote's name and URL, and one `<local ref> <local oid> <remote ref> <remote oid>`
+// line per ref. A hook that reads them (`git lfs pre-push` uploads exactly the objects those lines
+// name) would otherwise act on nothing. Both pushes `git_command.push` makes send the current branch to
+// the same name on `origin`, so that is the one line written. Like git, an up-to-date branch runs no
+// hook: the remote-tracking ref already naming `HEAD` is git's "Everything up-to-date".
+
+const REMOTE = 'origin'
+const HOOK_NAME = 'pre-push'
+const PROBE_HOOK_NAME = 'kit-hook-run-probe'
+const ALLOW_UNKNOWN_HOOK_NAME_FLAG = '--allow-unknown-hook-name'
+const HOOK_RUN = 'run'
+const STDIN_FILE = 'refs'
+const TEMPORARY_PREFIX = 'kit-pre-push-'
+const ZERO_DIGIT = '0'
+
+interface PushReferences {
+	branch: string
+	local_oid: string
+	remote_oid: string | undefined
+}
+
+// `undefined` is a branch the remote has never seen, which git reports with an all-zero object id.
+async function read_remote_oid(branch: string): Promise<string | undefined> {
+	try {
+		return await git_spawn.read([
+			'rev-parse',
+			'--verify',
+			'--quiet',
+			`refs/remotes/${REMOTE}/${branch}`,
+		])
+	} catch {
+		return undefined
+	}
+}
+
+async function read_push_references(): Promise<PushReferences> {
+	const [branch, local_oid] = await Promise.all([
+		git_spawn.read(['rev-parse', '--abbrev-ref', 'HEAD']),
+		git_spawn.read(['rev-parse', 'HEAD']),
+	])
+
+	return { branch, local_oid, remote_oid: await read_remote_oid(branch) }
+}
+
+// The zero id takes the local id's length, so a SHA-256 repository gets 64 digits rather than 40.
+function to_stdin_line(references: PushReferences): string {
+	const reference = `refs/heads/${references.branch}`
+	const remote_oid = references.remote_oid ?? ZERO_DIGIT.repeat(references.local_oid.length)
+
+	return `${reference} ${references.local_oid} ${reference} ${remote_oid}\n`
+}
+
+function to_hook_run_arguments(stdin_path: string, hook_name: string): Array<string> {
+	return [HOOK_RUN, '--ignore-missing', `--to-stdin=${stdin_path}`, hook_name]
+}
+
+// **A git that cannot run the hook this way leaves it to the push** — `git hook run` is Git 2.36, and
+// `--to-stdin` later still; an older git exits 129 on either. It is asked with a hook name nothing
+// configures, which `--ignore-missing` turns into a clean exit on any git that understands the call,
+// so the answer never depends on what the real hook does. Git 2.54 refuses a name that is not a
+// native hook unless `--allow-unknown-hook-name` says otherwise, and a git before it refuses that flag,
+// so the probe is asked both ways.
+async function can_probe(probe_arguments: ReadonlyArray<string>): Promise<boolean> {
+	try {
+		await git_spawn.read(['hook', ...probe_arguments])
+
+		return true
+	} catch {
+		return false
+	}
+}
+
+async function can_run_hooks(stdin_path: string): Promise<boolean> {
+	const [, ...options] = to_hook_run_arguments(stdin_path, PROBE_HOOK_NAME)
+
+	if (await can_probe([HOOK_RUN, ALLOW_UNKNOWN_HOOK_NAME_FLAG, ...options])) return true
+
+	return await can_probe([HOOK_RUN, ...options])
+}
+
+async function run_with_stdin(stdin_line: string): Promise<boolean> {
+	const directory = await mkdtemp(path.join(tmpdir(), TEMPORARY_PREFIX))
+	const stdin_path = path.join(directory, STDIN_FILE)
+
+	try {
+		await writeFile(stdin_path, stdin_line)
+		if (!(await can_run_hooks(stdin_path))) return false
+		const url = await git_spawn.read(['remote', 'get-url', REMOTE])
+
+		await git_spawn.with_output('hook', [
+			...to_hook_run_arguments(stdin_path, HOOK_NAME),
+			'--',
+			REMOTE,
+			url,
+		])
+
+		return true
+	} finally {
+		await rm(directory, { force: true, recursive: true })
+	}
+}
+
+// `true` when the hook is settled here — run, or nothing to push — so the push skips it; `false` when
+// this git cannot run it, so the push runs it as it always did. A hook that fails throws
+// `git hook exited with code <n>`, and the push is never attempted.
+async function run(): Promise<boolean> {
+	const references = await read_push_references()
+
+	if (references.local_oid === references.remote_oid) return true
+
+	return await run_with_stdin(to_stdin_line(references))
+}
+
+const git_pre_push_hook = {
+	run,
+}
+
+export { git_pre_push_hook }